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DETAILED ACTION 
Claims 2-3, 11-16, 46, 60, 73, 82, 84 and 86 have been cancelled. 

Continued Examination Under 37 CFR 1.114 

1 . A request for continued examination under 37 CFR 1.114, including the fee set forth in 
37 CFR 1.17(e), was filed in this application after final rejection. Since this application is 
eUgible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) 
has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 
37 CFR 1.1 14. Applicant's submission filed on 02/23/2010 has been entered. 

Claim Objections 

2. Claim 18 is objected to under 37 CFR 1 .75(c), as being of improper dependent form for 
failing to fiirther limit the subject matter of a previous claim. Applicant is required to cancel the 
claim(s), or amend the claim(s) to place the claim(s) in proper dependent form, or rewrite the 
claim(s) in independent form. According to claim 1, the bit entry fields are used to designate 
each DPM as current or previous. 

Claim Rejections - 35 USC § 112 

3. The following is a quotation of the second paragraph of 35 U.S.C. 1 12: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

4. Claims 1, 4-10, 17-45, 47-59, 61-72, 74-81, 83, 85 and 87-93 are rejected under 35 
U.S.C. 1 12, second paragraph, as being indefinite for failing to particularly point out and 
distinctly claim the subject matter which applicant regards as the invention. 

5. The term "substantially equal" in claims 1, 36, 55, 68 and 81 is a relative term which 
renders the claim indefinite. The term "substantially equal" is not defined by the claim, the 
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specification does not provide a standard for ascertaining the requisite degree, and one of 
ordinary skill in the art would not be reasonably apprised of the scope of the invention. 

Claim Rejections - 35 USC § 101 

6. 35 U.S.C. 101 reads as follows: 

Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or 
any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and 
requirements of this title. 

7. Claims 68-72 and 74-80 are rejected under 35 U.S.C. 101 because the claimed invention 

is directed to non-statutory subject matter. The computer-readable storage medium would 
include signals because the specification does not limit the scope of the computer readable 
storage medium to non-transitory embodiments (see paragraph 0067). The Examiner suggests 
changing the "computer-readable storage medium" to " non-transitory computer-readable storage 
medium". 

Claim Rejections - 35 USC § 103 

8. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

9. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 
(1966), that are applied for establishing a background for determining obviousness under 35 
U.S.C. 103(a) are summarized as follows: 

1 . Determining the scope and contents of the prior art. 

2. Ascertaining the differences between the prior art and the claims at issue. 

3. Resolving the level of ordinary skill in the pertinent art. 
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4. Considering objective evidence present in the application indicating obviousness 
or nonobviousness. 

10. Claims 1, 4-6, 9-10, 17-18, 23, 27-30, 36-39, 42, 44-45, 47-49, 55-59, 61-63, 68-72 and 
74-76 are rejected under 35 U.S.C. 103(a) as being unpatentable over Aguilera et al. (US Pg Pub 
2005/0022009), hereinafter referred to as Aguilera, in view of Milliken (US Pg Pub 

2003/01 15485) and Comett, JR et al. (US Pg Pub 2003/0189916), hereinafter referred to as 
Comett. 

1 1 . For claims 1, 36, 55, 68 and 81, Aguilera suggests a duplicate packet map (DPM) (bit 
arrays 26, 28 and 30; see figure 2), wherein said DPM comprises first DPM field (epoch 7831) 
comprising a first plurality of bit entries (bit array 28 is assigned to epoch 783 1 ; see figure 2), a 
second DPM field (epoch 7832) comprising a second plurality of bit entries (bit array 26 is 
assigned to epoch 7832; see figure 2), said first DPM field is designated as a previous time 
interval field (epoch 7831 is the previous time interval; see paragraph 0016), said second DPM 
field is designated as a current time interval field (epoch 7832 is the current time interval; see 
paragraph 0016), said previous time interval field corresponds to a previous time interval, said 
current time interval field corresponds to a current time interval (the epochs are time intervals; 
see paragraph 0016), said previous time interval occurs before said current time interval (epoch 
7831 preceded epoch 7832; see paragraph 0016), said previous time interval is distinct from said 
current time interval (Aguilera suggests the epochs are distinct because each epoch is assigned a 
distinct identifier; see figure 2) and a DPM bank (bloom filter), wherein said DPM bank is 
configured to store a plurality ofDPMs and said plurality ofDPMs comprises said DPM (the bit 
arrays 26, 28 and 30 are stored in a bloom filter; see paragraph 0016). 
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12. Aguilera discloses a packet summary value (PSV) generator (CPU 62 executing software 
code; see paragraph 0027), wherein said DPM (bVoom filter) is coupled to said PSV generator 
(the bit arrays 26, 28 and 30 of the bloom filter are stored in RAM 66; see paragraph 0027. 
Figure 5 shows CPU 62 is coupled to RAM 66), said PSV generator is configured to, responsive 
to receiving a packet, generate a hash value (see paragraph 0017). Aguilera does not disclose the 
source of the hashed value. Milliken discloses a hash value that is generated by extracting data 
from said packet (hash values are generated from the payload of a packet; see paragraph 0046), 
and calculate a PSV using said data from said packet by virtue of being configured to generate 
hashed data by hashing said data from said packet using a hashing function (the payload is used 
to generate a hash value; see paragraph 0046), wherein said PSV corresponds to said hashed 
data, said DPMis configured to receive said PSViihe hash values are stored in hash memory 
320; see paragraph 0050). It would have been obvious to a person of ordinary skill in the art at 
the time of the invention to use Milliken's hashing method in Aguilera's invention to detect 
network worms and viruses (Milliken, title). 

1 3 . Aguilera discloses each epoch is based on the current time and previous time interval (see 
paragraph 0015). Aguilera does not disclose epochs that have the same interval durations. 
Comett discloses said previous time inten^al is substantially equal in duration to said current 
time interval (figure 3 shows epochs that have the same interval duration). It would have been 
obvious to a person of ordinary skill in the art at the time of the invention to use substantially 
equivalent duration time intervals in Aguilera's invention to establish traffic channels (Comett, 
title). 
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14. Specifically for claim 55, Aguilera discloses a processor (CPU 62; see figure 5); a 
computer readable medium (RAM 66 and ROM 64) coupled to said processor (figure 5 shows 
the CPU 62, RAM 66 and ROM 64 are coupled); and computer code (software code), encoded in 
said computer readable medium (the software code is encoded in the ROM 64; see paragraph 
0027). 

15. For claims 4 and 17, Aguilera discloses wherein said DPM (bit arrays 26, 28 and 30; see 
figure 2) is implemented as a Bloom filter (the bit arrays 26, 28 and 30 are part of a bloom filter; 
see paragraph 0016). 

16. For claim 5, Aguilera discloses wherein a hit entry of each said first and second DPM 
fields corresponds to said P»SF(each bit in the bit arrays corresponds to a hash value; see 
paragraph 0017 and figure 3 step 46). 

17. For claim 6, Aguilera discloses said PSV comprises a third plurality of bit entries (the 
hash value can have any number of bit entries; see figure 3 item 42), and each bit entry of said 
first and second DPM fields corresponds to a bit in said third plurality of bit entries of said PSV 
(each bit of the hash function corresponds to a bit in the bit arrays; see figure 3 item 46). 

7. For claims 9 and 29, Aguilera discloses the use of hashing functions (see paragraph 
0012). Aguilera does not disclose the use of CRC checks. Milliken discloses said PSV 
generator (hash processor 310) is configured to calculate said PSV using a cyclic redundancy 
check (CRC) calculation (the hashing algorithms used by the hash processor 310 include CRC; 
see paragraph0047) and said data from said packet is path-independent (the hashing is 
performed on the payload of the packet; see paragraph 0046. The payload of the packet does not 
define the path a packet will take). It would have been obvious to a person of ordinary skill in 
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the art at the time of the invention to use Milliken's hashing method in Aguilera's invention to 
detect network worms and viruses (Milliken, title). 

8. For claim 10, Aguilera discloses the use of hashing functions (see paragraph 0012). 
Aguilera does not disclose the use of CRC checks. Milliken discloses the data from said packet 
excludes header and trailer information (the hashing is performed on the payload of the packet; 
see paragraph 0046). It would have been obvious to a person of ordinary skill in the art at the 
time of the invention to use Milliken's hashing method in Aguilera's invention to detect network 
worms and viruses (Milliken, title). 

18. For claims 18, 47, 61 and 74, Aguilera discloses a first one of said DPMs is designated 
as a current DPM (the bit array 26 is assigned to current epoch 7832; see figure 2), and a second 
one of said DPMs is designated as a previous DPM (the bit array 28 is assigned to the previous 
epoch 7831; see figure 2 and paragraph 0016). 

19. For claim 23, Aguilera discloses said PSV generator is coupled to each of said DPMs 
(the CPU 62 is coupled to the bit arrays of the bloom filter via RAM 66; see paragraph 0027). 

20. For claim 27, Aguilera discloses a packet summary value (PSV) generator (CPU 62 
executing software code; see paragraph 0027), wherein said DPM (\Aoom filter) is coupled to 
said PSV generator (the bit arrays 26, 28 and 30 of the bloom filter are stored in RAM 66; see 
paragraph 0027. Figure 5 shows CPU 62 is coupled to RAM 66), said PSV generator is 
configured to, responsive to receiving a packet, generate a hash value (see paragraph 0017). 
Aguilera does not disclose the source of the hashed value. Milliken discloses a hash value that is 
generated by extracting data from said packet (hash values are generated from the payload of a 
packet; see paragraph 0046), and calculate a PSV using said data from said packet by virtue of 
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being configured to generate hashed data by hashing said data from said packet using a hashing 
fiinction (the payload is used to generate a hash value; see paragraph 0046), wherein said PSV 
corresponds to said hashed data, said DPMis configured to receive said PSViihe hash values 
are stored in hash memory 320; see paragraph 0050). It would have been obvious to a person of 
ordinary skill in the art at the time of the invention to use Milliken's hashing method in 
Aguilera's invention to detect network worms and viruses (Milliken, title). 

21 . For claim 28, Aguilera discloses said DPM is further configured to indicate that said 
PSV matches a PSV stored in said DPM (see figure 1 step 14). 

22. For claim 30, Aguilera discloses a packet processing unit, said packet processing unit 
comprising said PSV generator (CPU 62 executes software to implement the hashing functions; 
see paragraph 0027). 

23. For claims 37, 56 and 69, Aguilera discloses indicating said packet is said duplicate 

packet, if said determining determines said packet is said duplicate packet (if a hash value 
matches all bits in a bloom filter, the packet is considered to be a duplicate; see paragraph 0013 
and figure 1). 

24. For claim 38, Aguilera suggests dropping said packet, if said packet is said duplicate 
packet (if the packet is a duplicate, the server does not process the request; see figure 1). 

25 . For claims 39, 57 and 70, Aguilera discloses comparing said PSV to said first DPM 
field, and comparing said PSV to said second DPM field (see item 14 of figure 1). 

26. For claims 42, 58 and 71, Aguilera suggests selecting a bit entry of said first DPM field 
based on said PSV a and selecting a bit entry of said second DPM field based on said PSV (the 
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CPU 62 searches through all the bit arrays in the bloom filter to find a match; see figure 1 step 
14). 

27. For claim 44, Aguilera discloses setting said value of said corresponding bit entry of said 
first plurality of bit entries if said packet is not said duplicate packet (see figure 1 step 18). 

28. For claim 45, 59 and 72, Aguilera discloses a packet summary value (PSV) generator 
(CPU 62 executing software code; see paragraph 0027), wherein said DPM (bloom filter) is 
coupled to said PSV generator (the bit arrays 26, 28 and 30 of the bloom filter are stored in 
RAM 66; see paragraph 0027. Figure 5 shows CPU 62 is coupled to RAM 66), said PSV 
generator is configured to, responsive to receiving a packet, generate a hash value (see 
paragraph 0017). Aguilera does not disclose the source of the hashed value. Milliken discloses a 
hash value that is generated by extracting data from said packet (hash values are generated from 
the payload of a packet; see paragraph 0046), and calculate a PSV using said data from said 
packet by virtue of being configured to generate hashed data by hashing said data from said 
packet using a hashing function (the payload is used to generate a hash value; see paragraph 
0046), wherein said PSV corresponds to said hashed data, said DPM is configured to receive 
said PSViihe hash values are stored in hash memory 320; see paragraph 0050); said PSV 
generator (hash processor 310) is configured to calculate said PSV using a cyclic redundancy 
check (CRC) calculation (the hashing algorithms used by the hash processor 310 include CRC; 
see paragraph0047) and said data from said packet is path-independent (the hashing is 
performed on the payload of the packet; see paragraph 0046). It would have been obvious to a 
person of ordinary skill in the art at the time of the invention to use Milliken's hashing method in 
Aguilera's invention to detect network worms and viruses (Milliken, title). 
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29. For claims 48, 62 and 75, Aguilera suggests determining if a field of said previous DPM 
indicates said packet is said duplicate packet, using saidPSV; and determining if a field of said 
current DPM indicates said packet is said duplicate packet, using said PSV (the hash value is 
used to search all the bit arrays in the bloom filter for a match; see figure 1 item 14). 

30. For claims 49, 63 and 76, Aguilera suggests indicating said packet is not said duplicate 
packet, if said field of said previous DPM indicates said packet is not said duplicate packet and 
said field of said current DPM indicates said packet is not said duplicate packet, and indicating 
said packet is said duplicate packet, otherwise (if no bit array in the bloom filter matches the 
hash value, the request is not considered to be a duplicate request; see figure 1 ). 

31. Claims 24, 31-35 50-54, 64-67 and 77-80 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Aguilera in view of Milliken and Comett as applied to claims 23, 30, 47, 61 
and 74 respectively above, and further in view of Khansari et al. (US 6,446,131), hereinafter 
referred to as Khansari. 

32. For claim 24, the combination of Aguilera, Comett and Milliken does not disclose the 
use of DPM addressing and control units. Khansari teaches a DPM addressing unit coupled to 
said DPM (see col. 7 lines 50-56; The addressing unit provides the PSV to the table.) and a DPM 

control unit, coupled to control the DPM addressing unit and the DPM{sqq col. 7 lines 39-45; 
The control unit controls the duplicate packet detection/processing.). It would have been 
obvious to a person of ordinary skill in the art at the time of the invention to use DPM addressing 
and control units in Aguilera' s invention to indicate when duplicate packets have been received 
(BChansari, col. 7 lines 50-56). 



Application/Control Number: 10/626,792 Page 11 

Art Unit: 2473 

33. For claim 31, the combination of Aguilera, Comett and Milliken discloses said DPM 
bank comprises said DPM (bit arrays 26, 28 and 30 are stored in a bloom filter; see paragraph 
0016). The combination of Aguilera, Comett and Milliken does not disclose the use of hit 
signals. Khansari teaches the DPM bank comprises the DPM (see col. 7 lines 43-45), the DPM 
bank is configured to generate a hit signal (see col. 7 lines 46-50), and the DPM bank is coupled 
to receive the PSV from the PSV generator (see col. 7 lines 50-55) and to provide the hit signal 
to the packet processing unit (see col. 7 lines 33-43). It would have been obvious to a person of 
ordinary skill in the art at the time of the invention to use hit signals in Aguilera' s invention to 
indicate when duplicate packets have been received (Khansari, col. 7 lines 50-56). 

34. For claim 32, the combination of Aguilera, Comett and Milliken discloses a value of said 
PSV matches a value stored in a one of said DPMs (see figure 1 step 14). The combination of 
Aguilera, Comett and Milliken does not disclose the use of hit signals. Khansari discloses said 
hit signal (see col. 7 Unes 46-50). It would have been obvious to a person of ordinary skill in the 
art at the time of the invention to use hit signals in Aguilera' s invention to indicate when 
duplicate packets have been received (Khansari, col. 7 lines 50-56). 

35. For claim 33, the combination of Aguilera, Comett and Milliken discloses bit values of 

said PSV match bit values stored in corresponding locations in a one of said DPMs (see figure 1 
step 14). The combination of Aguilera, Comett and Milliken does not disclose the use of hit 
signals. Khansari discloses said hit signal (see col. 7 lines 46-50). It would have been obvious 
to a person of ordinary skill in the art at the time of the invention to use hit signals in Aguilera' s 
invention to indicate when duplicate packets have been received (Khansari, col. 7 lines 50-56). 
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36. For claim 34, the combination of Aguilera, Comett and Milliken does not disclose a 
processor that processes packets using hit signals. Khansari discloses the packet processing unit 
is configured to process the packet using the hit signal (see col. 7 lines 34-36). It would have 
been obvious to a person of ordinary skill in the art at the time of the invention to use hit signals 
in Aguilera' s invention to indicate when duplicate packets have been received (Khansari, col. 7 
lines 50-56). 

37. For claim 35, the combination of Aguilera, Comett and Milliken does not disclose the 
dropping of packets based on hit signals. Khansari discloses the processing includes causing the 
packet processing unit to drop the packet based on the hit signal (see Khansari, col. 7 lines 34- 
36). It would have been obvious to a person of ordinary skill in the art at the time of the 
invention to use hit signals in Aguilera' s invention to indicate when duplicate packets have been 
received (Khansari, col. 7 lines 50-56). 

38. For claims 50, 64 and 77, the combination of Aguilera, Comett and Milliken suggests 
using multiple DPMs and designating a current DPM as well as inactive and previous DPMs 
(see Aguilera, paragraph 0016 and figure 2). 

9. The combination of combination of Aguilera and Milliken does not disclose how the 
DPM is portioned. Khansari teaches designating a portion of the table as inactive or previous 
and using a portion as the current DPM (see col. 8 lines 1-5). It would have been obvious to a 
person of ordinary skill in the art at the time of the invention to use active and inactive fields in 
the DPM to indicate duplicates in Aguilera' s invention to be able to age the DPM table entries 
(BChansari, col. 7 lines 64-65). 
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10. For claim 51, the combination of Aguilera, Comett and Milliken suggests using multiple 
DPMs and designating a current DPM as well as inactive and previous DPMs (see Aguilera, 
paragraph 0016 and figure 2). 

1 1 . The combination of Aguilera, Comett and Milliken does not disclose the use of DPM 
portions. Khansari teaches clearing the inactive portion of the DPM prior to using it as the 
current DPM (see col. 8 lines 1-5). It would have been obvious to a person of ordinary skill in 
the art at the time of the invention to use active and inactive fields in the DPM to indicate 
duplicates in Aguilera's invention to be able to age the DPM table entries (Khansari, col. 7 lines 
64-65). 

12. For claims 52, 54, 65, 67, 78 and 80, the combination of Aguilera, Comett and Milliken 
suggests using multiple DPMs and designating a current DPM as well as inactive and previous 
DPMs (see Aguilera, paragraph 0016 and figure 2). 

13. The combination of Aguilera, Comett and Milliken does not disclose the use of active 
and inactive DPM portions. Khansari teaches the act of periodically reducing the DPM by 
selecting the inactive and active portions of the DPM (see col. 8 lines 1-5). It would have been 
obvious to a person of ordinary skill in the art at the time of the invention to use active and 
inactive fields in the DPM in Aguilera's invention to be able to age the DPM table entries 
(IChansari, col. 7 lines 64-65). 

39. For claims 53, 66 and 79, the combination of Aguilera, Comett and Milliken does not 
disclose a period for periodically selecting DPM fields. Khansari fiirther teaches a period of the 
performing periodically is such that the period is greater than an expected differential between 
duplicate packet arrivals and the period is less than a time between packet retransmissions (see 
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col. 8 lines 6-14). It would have been obvious to a person of ordinary skill in the art at the time 
of the invention to periodically select DPM fields in Milliken's invention to be able to age the 
DPM table entries (Khansari, col. 7 lines 64-65). 

Response to Arguments 

40. Applicant's arguments with respect to claims 1, 4-10, 17-45, 47-59, 61-72, 74-81, 83, 85 
and 87-93 have been considered but are moot in view of the new ground(s) of rejection. 

Allowable Subject Matter 

41 . Claims 7-8, 19-22, 25-26, 40-41, 43 and 93 are objected to as being dependent upon a 
rejected base claim, but would be allowable if rewritten in independent form including all of the 
limitations of the base claim and any intervening claims. 

42. Claims 81, 83, 85, 87 and 88-92 would be allowable if rewritten or amended to 
overcome the rejection(s) under 35 U.S.C. 1 12, 2nd paragraph, set forth in this Office action. 

Conclusion 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to JEFFREY M. RUTKOWSKI whose telephone number is 
(571)270-1215. The examiner can normally be reached on Monday - Friday 7:30-5:00 PM EST. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kwang Yao can be reached on (571) 272-3182. The fax phone number for the 
organization where this application or proceeding is assigned is 571-273-8300. 
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Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would 
like assistance from a USPTO Customer Service Representative or access to the automated 
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. 

/Jeffrey M Rutkowski/ 
Examiner, Art Unit 2473 



/KWANG B. YAO/ 

Supervisory Patent Examiner, Art Unit 2473 



